Known malicious kithighphishing
btbuu Fake Crypto Exchange — kline.min.js
family: btbuu-fake-crypto-exchange
Short link:scanmalware.com/h/14
Fake crypto-derivatives exchange kit. Operator-deployed K-line / Contract / Trade UI across btbuu.com, wbitx.cfd, trade-maxs.com, evergreen-capital.org. Path pattern /Public/Static/js/*, page pattern /Contract/index, /Trade/index?type=buy&symbol=*. The kit also bundles the genuine pako.min.js zlib library, which is not used as an anchor; these are the operator-specific files.
Anchors
Provenance
Added: 2026-05-26 14:39
Anchor #1 of 2. kline.min.js — operator-specific K-line chart code, 12,655 nodes.
Sightings (15)
| Host | Scan | Script | Match | When |
|---|---|---|---|---|
| atdscoin.com | f4715569… | https://atdscoin.com/Public/Static/js/kline.min.js | byte | 2026-09-17 11:30 |
| atdscoin.com | 7e9914a4… | https://atdscoin.com/Public/Static/js/kline.min.js | byte | 2026-09-17 06:12 |
| huobi089.com | f3545b60… | https://huobi089.com/Public/Static/js/kline.min.js | byte | 2026-07-10 10:27 |
| huobi652.com | 262e0681… | https://huobi652.com/Public/Static/js/kline.min.js | byte | 2026-07-10 08:30 |
| huobi202.com | 28adcdc5… | https://huobi202.com/Public/Static/js/kline.min.js | byte | 2026-07-08 12:19 |
| wbitx.cfd | 96bbc667… | https://wbitx.cfd/Public/Static/js/kline.min.js | byte | 2026-05-24 22:59 |
| wbitx.cfd | 2f746098… | https://wbitx.cfd/Public/Static/js/kline.min.js | byte | 2026-05-24 22:51 |
| wbitx.cfd | 9d3c53b7… | https://wbitx.cfd/Public/Static/js/kline.min.js | byte | 2026-05-24 22:31 |
| wbitx.cfd | d5a15786… | https://wbitx.cfd/Public/Static/js/kline.min.js | byte | 2026-05-24 21:58 |
| trade-maxs.com | fb92d2c9… | https://trade-maxs.com/Public/Static/js/kline.min.js | byte | 2026-05-24 16:10 |
| trade-maxs.com | 4799538d… | https://trade-maxs.com/Public/Static/js/kline.min.js | byte | 2026-05-24 15:30 |
| evergreen-capital.org | d6791f0f… | https://evergreen-capital.org/Public/Static/js/kline.min.js | byte | 2026-05-24 06:54 |
| trade-cex.com | ee525377… | https://trade-cex.com/Public/Static/js/kline.min.js | structure | 2026-05-24 01:18 |
| btbuu.com | 801bdf96… | https://btbuu.com/Public/Static/js/kline.min.js | byte | 2026-05-23 16:31 |
| btbuu.com | 82af296c… | https://btbuu.com/Public/Static/js/kline.min.js | byte | 2026-05-23 08:29 |